Writing an acceptable use policy

Why a small business needs one

An acceptable use policy, often shortened to AUP, sets out the rules for using your organization's technology. Without one, staff are left to guess whether they can install software, forward work email to a personal account or let a family member use a work laptop. Most people want to do the right thing, but they cannot follow rules nobody has written down.

A policy also supports your obligations under privacy laws such as PIPA, which expect reasonable security arrangements. Written expectations, combined with training and technical controls, form part of that picture. Insurers increasingly ask whether you have documented security policies, and an AUP is usually the first one they expect to see on file.

What to include

Keep the policy focused on the decisions staff actually face. A two to four page document that people read is far more useful than a thirty page manual that nobody opens. Write in plain language, explain the reason behind each rule briefly and avoid technical jargon wherever you can. The list below covers the topics most small organizations need to address.

You can add sections for specific situations, such as social media use or generative AI tools, as your needs grow. Many organizations now include a short statement on whether staff may paste client or company information into public AI services, since this is a common question and an easy way for confidential information to leave your control.

• Who the policy applies to, including contractors
• Use of company devices, email and internet
• Password and multi-factor authentication rules
• Installing software and browser extensions
• Storing and sharing company and client information
• Personal devices used for work
• Monitoring and privacy expectations
• How to report a lost device or suspected incident

Be honest about monitoring

If your organization monitors email, internet use or devices, the policy should say so in clear terms. Under Alberta privacy law, employee personal information has its own rules, and collecting it generally needs to be reasonable for managing the employment relationship, with notice given to employees. Surprises about monitoring damage trust and can create legal problems that are hard to undo.

Describe what is monitored, why and who can see the results. Keep monitoring proportionate to the risk you are managing. Before introducing new monitoring tools, especially ones that record screens, track location or capture keystrokes, talk to your lawyer about how they fit with your obligations to employees and whether a privacy impact assessment would be wise.

Personal devices and remote work

Many small teams use personal phones for work email or occasionally work from a home computer. Your policy should state what is allowed and the minimum requirements, such as a screen lock, current software updates and approved apps for accessing company data. If you use mobile device management, explain what it can and cannot see on a personal phone, because that is the first question staff will ask.

For remote work, address home Wi-Fi security, printing at home, working in public places and keeping family members away from work devices. These details matter more than they seem, because home environments are where many accidental disclosures happen. Give practical examples, such as locking the screen when stepping away and shredding printed client documents rather than putting them in household recycling.

Rolling it out

Have each employee read and acknowledge the policy when they start and whenever it changes. A signed form or an electronic acknowledgement in your HR system both work. Walk through the key points in a short team meeting rather than simply emailing a document, and give people a chance to ask questions about situations that apply to their role.

Review the policy once a year with your IT provider and update it when you introduce new systems or tools. Enforce it consistently. A policy that is ignored for some people and applied to others is difficult to rely on when you need it, and it sends a confusing message to the rest of the team.